Re: [libvirt] [PATCH 06/10] apparmor, virt-aa-helper: Additional explicit denies for host devices
On 15.05.2017 17:56, Guido Günther wrote: > On Mon, May 15, 2017 at 03:23:15PM +0200, Stefan Bader wrote: >> From: Christian Ehrhardt>> >> This adds further explicit denies for host devices to silence >> (acceptable) denial warnings. >> >> Signed-off-by: Christian Ehrhardt >> Signed-off-by: Stefan Bader >> --- >> examples/apparmor/usr.lib.libvirt.virt-aa-helper | 4 >> 1 file changed, 4 insertions(+) >> >> diff --git a/examples/apparmor/usr.lib.libvirt.virt-aa-helper >> b/examples/apparmor/usr.lib.libvirt.virt-aa-helper >> index 7804b72..012080c 100644 >> --- a/examples/apparmor/usr.lib.libvirt.virt-aa-helper >> +++ b/examples/apparmor/usr.lib.libvirt.virt-aa-helper >> @@ -24,6 +24,10 @@ profile virt-aa-helper >> /usr/{lib,lib64}/libvirt/virt-aa-helper { >>deny /dev/sd* r, >>deny /dev/vd* r, >>deny /dev/dm-* r, >> + deny /dev/drbd[0-9]* r, >> + deny /dev/dasd* r, >> + deny /dev/nvme* r, >> + deny /dev/zd[0-9]* r, >>deny /dev/mapper/ r, >>deny /dev/mapper/* r, > > This could IMHO be squashed into the previous patch since it just > extends the list. I agree. another case of being not certain how to proceed with changes from different origins. -Stefan > Cheers, > -- Guido > > -- > libvir-list mailing list > libvir-list@redhat.com > https://www.redhat.com/mailman/listinfo/libvir-list > signature.asc Description: OpenPGP digital signature -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list
Re: [libvirt] [PATCH 06/10] apparmor, virt-aa-helper: Additional explicit denies for host devices
On Mon, May 15, 2017 at 03:23:15PM +0200, Stefan Bader wrote: > From: Christian Ehrhardt> > This adds further explicit denies for host devices to silence > (acceptable) denial warnings. > > Signed-off-by: Christian Ehrhardt > Signed-off-by: Stefan Bader > --- > examples/apparmor/usr.lib.libvirt.virt-aa-helper | 4 > 1 file changed, 4 insertions(+) > > diff --git a/examples/apparmor/usr.lib.libvirt.virt-aa-helper > b/examples/apparmor/usr.lib.libvirt.virt-aa-helper > index 7804b72..012080c 100644 > --- a/examples/apparmor/usr.lib.libvirt.virt-aa-helper > +++ b/examples/apparmor/usr.lib.libvirt.virt-aa-helper > @@ -24,6 +24,10 @@ profile virt-aa-helper > /usr/{lib,lib64}/libvirt/virt-aa-helper { >deny /dev/sd* r, >deny /dev/vd* r, >deny /dev/dm-* r, > + deny /dev/drbd[0-9]* r, > + deny /dev/dasd* r, > + deny /dev/nvme* r, > + deny /dev/zd[0-9]* r, >deny /dev/mapper/ r, >deny /dev/mapper/* r, This could IMHO be squashed into the previous patch since it just extends the list. Cheers, -- Guido -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list
[libvirt] [PATCH 06/10] apparmor, virt-aa-helper: Additional explicit denies for host devices
From: Christian EhrhardtThis adds further explicit denies for host devices to silence (acceptable) denial warnings. Signed-off-by: Christian Ehrhardt Signed-off-by: Stefan Bader --- examples/apparmor/usr.lib.libvirt.virt-aa-helper | 4 1 file changed, 4 insertions(+) diff --git a/examples/apparmor/usr.lib.libvirt.virt-aa-helper b/examples/apparmor/usr.lib.libvirt.virt-aa-helper index 7804b72..012080c 100644 --- a/examples/apparmor/usr.lib.libvirt.virt-aa-helper +++ b/examples/apparmor/usr.lib.libvirt.virt-aa-helper @@ -24,6 +24,10 @@ profile virt-aa-helper /usr/{lib,lib64}/libvirt/virt-aa-helper { deny /dev/sd* r, deny /dev/vd* r, deny /dev/dm-* r, + deny /dev/drbd[0-9]* r, + deny /dev/dasd* r, + deny /dev/nvme* r, + deny /dev/zd[0-9]* r, deny /dev/mapper/ r, deny /dev/mapper/* r, -- 2.7.4 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list